The Queen of Soul famously wailed about being a link in a chain of fools. Today’s lead story in the Boston Globe tells us about another sort of link in the chain — the weakest link in the chain of custody of patient records. In brief, a pathology billing service bought out by another service apparently dumped all records more that a year old in a town dump; a Globe photographer taking out his own trash noticed that the paper records (which he was looking at because he thought they ought to be recycled rather than dumped) had identifiable patient data and represented at least four hospitals from across Eastern Massachusetts. Clearly, these records ought to have been shredded or otherwise destroyed before disposal. Assuming they had some airtight contracts in place, the hospitals involved may well be looking to the seller of the billing service in this case to reimburse them for costs of:
- identifying the patients involved in this data breach
- notifying affected patients of the breach
- providing credit monitoring services to affected patients
- any damages incurred by patients
- any fines incurred by the hospitals
Under the HITECH Act’s “Son of HIPAA” rules, the hospitals could be on the hook to the federales for up to $1.5 million in fines each as a result of this incident, and the state AG could get in on the action as well, filing suit on behalf of the affected Massachusetts residents and seeking to ensue that proper procedures are in place. There may also be a violation of the state data security law here as well. Massachusetts has a particularly stringent data security law on the books that took effect within the past year, and not all affected businesses have come into compliance. The AG may be on the prowl for a few high-profile cases, like this one, in which to levy substantial fines and convince the laggards that compliance would be more than worth their while.
The natural question to ask, given the facts of this case, is: What Would a Meaningful User Do?
